a89d50884b1f12fed4811803625a270e132555d013d26c211907fd8e480830e8

Analysis

max time kernel
148s
max time network
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
04/08/2026, 22:29

Target
Emu.exe
Size 248KB
Sample260804-2ek15azsfs
SHA256 a89d50884b1f12fed4811803625a270e132555d013d26c211907fd8e480830e8
MD5 db0272f22913973dd0e10a4ce7682580
SHA1 c5c5819c4996a291042bdd819c16fcf0cb505856
SHA512 c8bda14715b9081122104a6824ff31053bc68bcb37531339753f6b21f0cadcd5b5abf1d83864d53ee7f156932945b415ae807a645188e60c8cd29517f4b121e8
SSDEEP 6144:NDgfruqoTsl/t/8ATCH1rplg8H6Oq4g+fF:Njhgl/t09HrlZVqluF
TLSH
T175447C3DBA280CBDDA6EC079EE83C906DF327C474365D6D713905AA20E176E59E3DA01
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Stops running service(s) 4 TTPs
defense_evasion execution

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Service Execution
T1569.002

Launches sc.exe 3 IoCs

Sc.exe is a Windows utlilty to control services on the system.

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

Windows Command Shell

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 552 wrote to memory of 2316	552	Emu.exe	90
PID 2316 wrote to memory of 4196	2316	cmd.exe	91
PID 552 wrote to memory of 6120	552	Emu.exe	92
PID 6120 wrote to memory of 252	6120	cmd.exe	93
PID 552 wrote to memory of 2172	552	Emu.exe	94
PID 2172 wrote to memory of 2828	2172	cmd.exe	95

C:\Users\Admin\AppData\Local\Temp\Emu.exe
"C:\Users\Admin\AppData\Local\Temp\Emu.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:552
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start vgk >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2316
- - C:\Windows\system32\sc.exe
    sc start vgk
    3⤵
    - Launches sc.exe
    PID:4196
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c sc stop vgc >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:6120
- - C:\Windows\system32\sc.exe
    sc stop vgc
    3⤵
    - Launches sc.exe
    PID:252
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start vgc >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2172
- - C:\Windows\system32\sc.exe
    sc start vgc
    3⤵
    - Launches sc.exe
    PID:2828